GCIH Hard Questions — 25 Difficult Questions

Question 1

When investigating a suspected malicious process in memory, why is it critical to analyze the 'Parent Process ID' (PPID) in conjunction with the process's execution path?

Accepted Answer

To detect anomalies in process lineage and execution context.. PPID analysis reveals the execution chain, which is often a major red flag for malicious activity. For example, a web server process spawning a shell is highly suspicious. Understanding these relationships allows incident handlers to detect process hollowing and injection attacks. This context is essential because it distinguishes between legitimate system operations and adversarial techniques designed to blend into the system's normal process hierarchy.

Answer

To identify which user account initiated the malicious activity.

Answer

To determine the file creation date on the disk.

Answer

To ensure the process is running with administrative privileges.

Question 2

Which THREE of the following are essential components of an effective AI-assisted malware hunting strategy?

Accepted Answer

Continuous ingestion of high-quality, normalized telemetry data.. Effective malware hunting requires a combination of strong data hygiene, human intuition, and robust analytical loops. AI provides the speed and pattern recognition necessary to handle large volumes of data, but it requires carefully curated inputs and human oversight to remain effective. These components are essential because they ensure that hunting efforts are scalable, reproducible, and aligned with the actual behavioral patterns observed during the adversary's lifecycle within the enterprise environment.

Answer

Eliminating all manual review to maximize the hunting speed.

Answer

Focusing exclusively on known malware signatures for speed.

Question 3

An application uses a Base64 encoded string as a parameter for object references. An attacker decodes the string, modifies the ID, re-encodes it, and successfully accesses unauthorized data. Why did the security control fail?

Accepted Answer

Base64 encoding is inherently reversible. The failure occurred because the application relied on encoding (Base64) as a security control instead of proper authorization logic. Encoding is a data representation technique, not a security mechanism. Because the server failed to perform access control checks on the decoded identifier, it allowed the attacker to bypass the intended security model. This highlights the importance of never confusing data format obfuscation with actual authorization or identity management.

Answer

The server failed to enforce HTTPS

Answer

The session token was not included in the payload

Answer

The application used an insecure hashing algorithm

Question 4

Refer to the exhibit. An analyst deploys this policy to detect threats. Why is the 'parent_process' condition specifically targeting 'w3wp.exe'?

Accepted Answer

To identify potential web shell execution or exploit payloads triggered via IIS.. The 'w3wp.exe' process is the IIS worker process. Attackers often exploit web vulnerabilities to spawn child processes, such as PowerShell, to execute malicious scripts directly from memory. By flagging PowerShell child processes of an IIS worker, the analyst is specifically monitoring for web shell activity or remote code execution, which are common vectors for initial access and persistence in web-facing server environments.

Answer

To detect unauthorized software installations performed by administrative users.

Answer

To prevent the web server from being used as a staging ground for brute force.

Answer

To ensure that all PowerShell scripts are signed and authorized by the organization.

Question 5

An incident handler is analyzing a severe Cross-Site Scripting (XSS) incident where malicious JavaScript stole administrator session cookies. Which TWO of the following defensive configurations and practices effectively mitigate session theft risks via XSS?

Accepted Answer

Set the HttpOnly flag on all sensitive authentication and session cookies.. Applying the HttpOnly flag prevents client-side scripts from accessing sensitive cookies via document.cookie, stopping direct session hijacking even if XSS exists. Combining this with a strong Content Security Policy restricts where scripts load and execute, providing defense-in-depth against malicious script injection attempts.

Answer

Require strict TLS 1.3 encryption for all incoming and outgoing web traffic sessions.

Answer

Store user session tokens inside local storage rather than standard browser cookies.

Answer

Encode all dynamic output using generic HTML entity encoding routines on the server side.

Question 6

An incident responder is investigating a compromised Windows host and suspects the presence of a covert command and control (C2) channel utilizing DNS tunneling. Which TWO registry locations or artifact categories should the analyst examine to identify DNS client cache activity and persistence associated with tunneling software?

Accepted Answer

The DNS Client service cache via PowerShell Get-DnsClientCache. Investigating DNS tunneling requires analyzing both the local DNS client cache to uncover historical malicious domain queries and examining Windows event logs specifically related to DNS client operations. These sources provide verifiable evidence of abnormal query volumes and structural encoding patterns used by tunneling tools.

Answer

SAM registry hive located at System32\config\SAM

Answer

SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key

Answer

NTUSER.DAT registry hive for the currently logged-in user

Question 7

An analyst discovers that an attacker has established persistence and a pivoting channel on a domain-joined Windows server using PsExec. Which TWO forensic artifacts or log sources should the analyst examine to identify evidence of this activity? (Choose TWO)

Accepted Answer

Windows Security Event Log ID 4697 indicating new service installation. PsExec relies on creating a remote service named PSEXESVC and writing corresponding binaries to the ADMIN$ share. Examining Windows Security Event logs for service creation events and inspecting the filesystem for residual temporary binaries provides definitive proof of lateral movement and endpoint compromise.

Answer

PowerShell Script Block Logging Event ID 4104 showing interactive console inputs

Answer

DNS query logs for external command and control domain resolution requests

Answer

DHCP lease allocation logs showing dynamic IP address reassignments

Question 8

During an investigation involving a compromised Linux server, an incident responder suspects an attacker installed a user-mode rootkit by replacing standard system binaries. The responder runs the 'rpm -Va' command to verify installed packages against the RPM database. Which specific finding from this verification output provides definitive cryptographic proof that the '/bin/netstat' binary has been modified?

Accepted Answer

A leading '5' indicator confirming that the cryptographic MD5 digest of the file does not match the RPM database record.. The rpm verification command checks installed files against the package database's cryptographic checksums and metadata. A digest or MD5 mismatch denoted by the '5' attribute flag indicates that the file contents on disk differ from the official package manifest, proving tampering occurred despite potential file timestamp manipulation.

Answer

A leading 'S' indicator showing that the file size has changed significantly compared to the original installation manifest.

Answer

A leading 'M' indicator demonstrating that the permission bits and file mode have been altered to grant world-writable access.

Answer

A leading 'T' indicator showing that the file modification timestamp was altered to conceal the exact time of the replacement.

Question 9

During an internal network vulnerability assessment, an incident handler needs to perform host discovery across a heavily segmented corporate environment where standard ICMP Echo requests are completely blocked by internal host firewalls. Which TWO Nmap discovery techniques should the analyst select to reliably identify live hosts without relying on ICMP Echo? (Choose TWO)

Accepted Answer

TCP SYN Ping (-PS443) targeting common web ports to trigger a SYN-ACK or RST response from active systems.. When ICMP Echo is blocked, analysts must leverage alternative probing techniques that traverse host firewalls. TCP SYN Ping (-PS) sends empty SYN packets to common ports like 80 or 443, which often bypass perimeter controls. UDP Ping (-PU) sends UDP packets to typically closed ports, triggering ICMP Port Unreachable responses that confirm a host is alive. Both methods effectively discover live systems when standard ping fails.

Answer

ICMP Information Request (-PE with alternate timestamp parameters) to bypass standard router filtering blocks.

Answer

ARP Ping (-PR) utilizing local broadcast frames to discover active nodes on the directly connected subnet.

Answer

TCP NULL Ping (-PN) to disable host discovery and force scanning of all specified IP addresses.

Question 10

To fully harden a network against NTLM relay attacks targeting the SMB protocol, which THREE defensive measures should be implemented in conjunction?

Accepted Answer

Enforce SMB Signing on all servers and workstations.. Hardening against SMB Relay requires a multi-layered approach. Enforcing SMB Signing prevents the actual relay from succeeding on the target. Disabling LLMNR and NBT-NS prevents attackers from redirecting victim traffic to their malicious listener. Implementing EPA (Extended Protection for Authentication) binds the authentication to the TLS tunnel, preventing the credential material from being used elsewhere.

Answer

Change the default SMB port from 445 to 4445.

Answer

Enable SMBv1 for legacy compatibility.

Question 11

An organization is migrating to SMB 3.1.1 to improve security. They want to ensure that if a Man-in-the-Middle attacker attempts to downgrade the dialect to a less secure version during the handshake, the connection is aborted. Which feature of SMB 3.1.1 provides this specific protection?

Accepted Answer

Pre-Authentication Integrity. SMB 3.1.1 introduced Pre-Authentication Integrity, which uses a cryptographic hash (SHA-512) to protect the negotiation and session setup phases. This prevents 'downgrade attacks' where an interceptor modifies the dialect list to force the client and server into using a weaker, more exploitable version of the protocol. It ensures the integrity of the initial handshake before authentication is even completed.

Answer

SMB Encryption

Answer

Secure Dialect Negotiation

Answer

Opportunistic Locking

Question 12

Refer to the exhibit. An application reflects user input directly into the HTML value attribute. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The exhibit shows input being reflected back into the HTML attribute without proper sanitization. This is a classic example of Reflected Cross-Site Scripting (XSS). Because the input is rendered inside a tag attribute, an attacker can break out of the context using quotes to execute arbitrary JavaScript. This highlights the danger of rendering untrusted input, requiring rigorous encoding or validation strategies to ensure the browser interprets data as literal text.

Answer

SQL Injection

Answer

Command Injection

Answer

Insecure Direct Object Reference (IDOR)

Question 13

A GCIH analyst is investigating a web application that uses Java deserialization to process user-supplied session objects. The analyst suspects an attacker exploited an insecure deserialization vulnerability to achieve remote code execution. Which two indicators are most likely to confirm this type of attack? (Choose two.)

Accepted Answer

HTTP requests containing serialized Java objects with the magic bytes AC ED 00 05 in the body.. Insecure deserialization attacks require delivering a serialized payload, which for Java begins with the AC ED 00 05 magic bytes. Successful exploitation often results in remote code execution, frequently followed by outbound connections for command-and-control or exfiltration. These two indicators together confirm both the delivery and the impact, whereas the other options are either unrelated or nonspecific.

Answer

The presence of a new administrator account created in the application's user database.

Answer

Database error messages containing SQL syntax errors.

Answer

A sudden increase in the number of 404 errors for static image files.

Question 14

During a cloud incident response engagement, an analyst reviews AWS CloudTrail logs and finds that an access key belonging to an IAM user was used from an unfamiliar IP address to call GetSecretValue against AWS Secrets Manager. The key is still active. Which immediate containment action best limits further credential misuse while preserving the ability to investigate who used the key?

Accepted Answer

Deactivate the access key with UpdateAccessKey, then rotate the key and review CloudTrail history associated with that key ID.. The exposed long-term access key is the active threat, so the priority is to make it unusable right away. Deactivating the key with UpdateAccessKey halts all API calls tied to that credential while leaving the IAM user and its policies intact for analysis. CloudTrail retains the access key ID in every event record, so the investigation can continue after containment. Rotating the credential afterward restores access without reintroducing the compromised secret.

Answer

Enable AWS GuardDuty and wait for its findings to confirm the anomaly before taking any action on the credential.

Answer

Delete the IAM user entirely with DeleteUser and recreate it later with the same permissions and a new access key.

Answer

Attach an inline IAM policy to the user that denies all actions with a Condition testing aws:SourceIp against the unfamiliar address.

Question 15

During an incident response engagement at a healthcare provider, you are examining network traffic captured from a compromised Linux web server. You see repeated outbound SSH connection attempts to dozens of internal hosts on port 22, each using the username 'svc_backup' and a different password from a short list. The attempts occur at roughly 50 per second and stop after two minutes. Which password attack technique does this activity most likely represent?

Accepted Answer

Horizontal brute-force attack. The activity shows a single username with a short password list tried across many internal hosts at high speed, which is the definition of horizontal brute-force (password spraying). This technique evades account lockout by limiting attempts per account while maximizing coverage across systems. Vertical brute-force, credential stuffing, and rainbow tables do not match the distributed, live SSH pattern seen here.

Answer

Rainbow table attack

Answer

Credential stuffing attack

Answer

Vertical brute-force attack

Question 16

When evaluating potential SQL injection in an application, what is the most significant indicator that an application is vulnerable?

Accepted Answer

User input is directly concatenated into a query string.. The most definitive indicator is the presence of dynamic SQL construction using unsanitized user input. When developers concatenate strings to build queries, the database cannot distinguish between data and command intent. Identifying code patterns where user parameters are directly appended to a SQL string is a critical step in security assessments. This practice allows attackers to manipulate the query structure, leading to unauthorized data exposure, bypasses, or administrative actions within the database management system.

Answer

The application uses a relational database management system.

Answer

The database contains sensitive user data.

Answer

The application is written in an interpreted language.

Question 17

Which of the following describes the 'Confused Deputy' problem in the context of cloud IAM roles?

Accepted Answer

A malicious user triggers a service to use its privileges against a resource.. The Confused Deputy problem occurs when a privileged service is coerced into performing an action on behalf of a user who lacks the permissions to perform that action directly. By utilizing 'External IDs' or 'Condition keys' like 'aws:SourceArn', developers can prevent this by ensuring that the service only assumes the role when the request originates from an authorized context, preventing unauthorized cross-account access and privilege escalation.

Answer

A user is assigned two different roles with conflicting permissions.

Answer

Two cloud administrators inadvertently delete each other's work.

Answer

A service fails to refresh its temporary tokens, causing a lockout.

Question 18

A GCIH incident responder is investigating a suspected API attack where an attacker manipulated a JSON Web Token (JWT) to gain unauthorized access. The responder needs to identify which two conditions would allow a JWT 'kid' (Key ID) header injection attack to succeed. (Choose two.)

Accepted Answer

The application allows the 'kid' header to specify an absolute path or URL that the server will fetch to obtain the key.. JWT 'kid' injection succeeds when the application uses the 'kid' header to determine the verification key without validating its content. If the 'kid' is used to build a file path or fetch a remote key, an attacker can manipulate it to use a key they control, forging valid tokens. The other conditions describe different JWT weaknesses.

Answer

The application uses a symmetric signing algorithm and the secret is weak or guessable.

Answer

The JWT is transmitted over an unencrypted HTTP connection, allowing token interception.

Answer

The application supports the 'none' algorithm and accepts unsigned tokens.

Question 19

A security analyst is investigating a suspected local file inclusion (LFI) attack against a PHP web application. The web server logs show the following request: `GET /download.php?file=php://filter/convert.base64-encode/resource=index.php`. The analyst needs to determine the attacker's objective and the potential impact. (Choose two.)

Accepted Answer

The attacker is attempting to read the source code of `index.php` by encoding it in Base64 to bypass PHP execution.. The payload uses the `php://filter` wrapper with Base64 encoding to read the source code of `index.php`. This technique bypasses PHP execution, allowing the attacker to view the raw code, which may contain sensitive information like database credentials. The other options misidentify the objective, such as command execution or CSRF, which are not supported by the specific payload.

Answer

The attacker is attempting to retrieve the contents of a sensitive file, such as `/etc/passwd`, by including it directly.

Answer

The attacker is attempting to perform a cross-site request forgery (CSRF) attack against the web application.

Answer

The attacker is attempting to execute arbitrary commands on the server via the `file` parameter.

Question 20

Which technique involves an attacker injecting code into a legitimate, running process to perform malicious activity while avoiding the detection of file-based scanning?

Accepted Answer

Process Injection. Process injection is a broad category of techniques where malicious code is forced into the memory space of another, healthy process. This is dangerous because the malicious activity appears to originate from the trusted process, potentially bypassing security controls. Responders must look for inter-process memory manipulation, such as calls to WriteProcessMemory or CreateRemoteThread, to identify when an adversary is attempting to hide their execution within a legitimate container.

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Answer

Memory Forensics